AUTH-006G — Announce a confirmed profile-name save and preserve focus

[daliu]

Foundation: #531 / PR #534. Conceptual profile parent: #118.

Officer impact: No live workflow change is claimed at issue creation. In the reviewed My Account source, a member who completes a confirmed full-name Save will see one plain result and will not be stranded when the Save control disappears.

Officer documentation: Update SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, and the existing My Account profile-name Mermaid, matching one-sentence text alternative, and one no-terminal source-evidence procedure in docs/officers/EVENTS_SHOP_MEMBERS.md.

Deployment evidence: None at issue creation. This is a source-only interface correction. No website publication, Firebase deployment, provider configuration, account/sign-in action, production-data action, or live behavior is authorized or claimed.

Atomic outcome

After one exact current full-name update and its successful non-null authoritative profile reread, show the fixed result Profile name saved. and restore otherwise-lost focus to that result only when the admitted Save control owned focus.

Defect

On exact released main 4f11ddd1f87cf10d40a620c1d32389276b8073f6, handleSave correctly waits for the update and a current authoritative reread, then collapses the editor. The focused Save button disappears, the page renders no success result, and keyboard or screen-reader focus can fall to the document body. The current attempt/app/Firestore/identity/UID/generation fences are strong and must remain compatible.

Invariants and transitions

• Validation, the synchronous one-attempt gate, write payload, captured context, authoritative reread, and current-attempt checks remain unchanged.
• A success result appears only after the exact current update completes and the exact current authoritative reread returns a non-null profile.
• The exact fixed result is Profile name saved.; it contains no name, email, UID, revision, provider detail, or caught value.
• The result uses role="status", aria-live="polite", aria-atomic="true", and tabIndex={-1}.
• The Profile header DOM order is heading, result, Edit. Scoped layout keeps the existing heading/Edit presentation while the result occupies the next row, so Tab from the focused result reaches Edit.
• A focus intent is armed only after validation and exact save admission, and only when the rendered Save control owns focus.
• The intent contains only the current opaque generation and attempt ID.
• Exact current confirmed success transfers the intent. A post-render effect consumes it before every target check.
• Focus is restored only from null, document body, document root, or a disconnected element. An already-focused result is left alone, and every other connected focused element is preserved.
• A programmatic or unfocused valid Save still shows the truthful result but never moves focus.
• Initial/background profile loads never show or focus the result.
• Validation failure, update rejection, missing or rejected confirmation read, unavailable recovery, context/resource/UID/identity change, A-to-unavailable-to-A generation change, a newer attempt, stale completion, and unmount cannot show or focus a stale result.
• Edit, a new admitted Save, profile reload, and context change clear the prior result and any obsolete focus intent.
• Focus and feedback add no read, write, request, retry, provider call, data URL, log, or stored value.
• Existing unconfirmed-change copy and recovery remain unchanged. Failure/retry focus is a separate outcome.

Exact ownership

• src/pages/account/Account.tsx: only confirmed-save result state/refs, exact focus intent transfer/consume, Profile-header markup/classes, and result clearing.
• src/pages/account/Account.test.tsx: one separately named AUTH-006G profile-save success feedback and focus block plus minimum directly affected assertions.
• src/pages/account/Account.css: only scoped Profile-header/result layout and programmatic-focus styling.
• SYSTEM_DESIGN.md: one separately named AUTH-006G source-only paragraph.
• IMPLEMENTATION_PLAN.md: one separately named AUTH-006G current-source paragraph.
• SECURITY.md: one separately named AUTH-006G/RISK-039 row, disjoint from active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 OAUTH-001A2L/RISK-024.
• docs/officers/EVENTS_SHOP_MEMBERS.md: only the existing My Account profile-name Mermaid, its one-sentence text alternative, and one separately named no-terminal AUTH-006G source-evidence procedure.

Required RED and GREEN evidence

• Capture trustworthy RED on unchanged runtime: focus Save, admit a deferred valid save, model disabled-control focus eviction, settle update plus authoritative reread, and prove the old page has neither the fixed result nor a focus destination.
• Prove exact copy, status/polite/atomic/tabIndex semantics, DOM-before-Edit order, visible scoped focus rule, and 320px containment.
• Prove the authoritative reread value reaches the summary and existing directory displayName prop with exactly one update and one confirmation read.
• Cover otherwise-lost null/body/document-root/disconnected restoration, already-focused no-redundant-focus behavior, and one-shot consumption.
• Preserve connected outside and connected in-Profile focus through settlement.
• Prove an unfocused/programmatic save shows the result without moving focus, including removing its outside origin before settlement and proving no delayed focus.
• Prove initial load, validation failure, update rejection, null reread, rejected reread, app-only, Firestore-only, identity-only, UID-only, unavailable/same-context generation, stale/newer attempt, and unmount paths cannot show or focus stale success.
• Preserve rapid-repeat counts, AUTH-006F privacy fences, existing generic errors, and default directory availability false.
• Bound CSS assertions to the exact rule block so removing the focus declarations fails the test.
• Run focused Account, full frontend, repository Node, TypeScript, scoped ESLint, unchanged lint baseline, diagnostic build, workflow/security tests, and diff check; obtain independent frontend/accessibility, security/privacy/race, and officer/operations reviews.

Explicit exclusions

• Unconfirmed-save retry focus.
• Validation aria-invalid or error association.
• Edit-to-input and Cancel-to-Edit focus.
• Directory component/service/runtime/tests/availability behavior.
• Account service, profile payload/validation semantics, Functions, Rules, schema, indexes, packages, workflows, provider configuration, Firebase deployment, accounts, sign-in, production data, publication, or live action.
• Membership, dues, role, payment, entitlement, roster, facial recognition, matching, embeddings, similarity, biometrics, or photo query.
• Active OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 Strava files and its separately named OAUTH-001A2L/RISK-024 hunk.

Migration and residual risk

No migration. This result proves only that the browser received the current authoritative profile after its update. It does not prove provider deployment, production availability, identity ownership beyond existing authentication, membership, dues, directory eligibility, or live behavior. The unconfirmed failure path and Edit/Cancel/validation focus gaps remain separate follow-ups.

Coordination

• Released AUTH-006F — Make My Account profile saves one-attempt and context-safe #531/AUTH-006F: fence My Account profile saves by current context #534 supplies the exact account-context and one-attempt fences.
• MEMBERS-DIRECTORY-001 — Add a private opt-in officer photo directory #504 coordinates the optional directory; this slice does not edit directory behavior.
• MEMBERS-DIRECTORY-001C — Release and verify the opt-in officer photo directory #507 retains every directory privacy/capability/staging/backend-first/release gate.
• OAUTH-001A2L — Bound Strava activity/statistics JSON and cancel the unread statistics body #616 owns only both Strava Function files and its separate SECURITY hunk; those are immutable.
• Pre-claim notices were posted before issue creation. No open PR or exact profile-save-focus claim was found.

Claim protocol

Creation is not a claim. Before editing, create a unique branch/worktree from exact current main, assign this issue, post and re-read a timestamped CLAIMED by /root at <UTC>; branch <branch>; base <SHA>; exact seven paths, and change status:ready to status:in-progress. The claim remains active through reviewed merge, exact-main/provider audit, closure, and explicit release.

[daliu]

CLAIMED by /root at 2026-08-14T03:25:19Z; branch codex/issue-651-profile-name-save-focus; base 4f11ddd; base tree cf61d8f2301462ff0d331257b9c07b69784703cc; exact paths: src/pages/account/Account.tsx, src/pages/account/Account.test.tsx, src/pages/account/Account.css, SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, SECURITY.md, docs/officers/EVENTS_SHOP_MEMBERS.md. Success-only scope; no source edit preceded this marker. Claim remains active through reviewed merge, exact-main/provider audit, closure, and explicit release.

[daliu]

RELEASED / COMPLETE after merge and exact-main audit.

• PR: AUTH-006G — Announce a confirmed profile-name save and preserve focus #652
• Reviewed candidate: 6eda03b9cedc69ba5ff81d951d7ba9472cb72179
• Exact merged main: cfe03c66b8f443cb4e160a80d335d966ba268e27
• Main/candidate tree: cd8c32d73021b026e145325d968f0a3cedf9bbff
• Exact base-to-main seven-path binary diff SHA-256: 27fa38b16444db7c823d9eb0e589d6e2ddc73839d61e32f6dd0729327b672dcc
• Runtime/test/CSS diff SHA-256: c00a6c7e0486dcdfbb0e9d0a4b4c48215f03e3e8c72634fc1f2b17142c08c1d5

Outcome: one exact current full-name update followed by its current successful non-null authoritative profile reread now renders the fixed polite atomic result Profile name saved.. Only an admitted Save that owned focus may restore otherwise-lost focus to that result; connected deliberate focus, programmatic/unfocused saves, stale contexts, failed/unconfirmed saves, and unmounted work remain focus-inert. Existing payloads, reads/writes, one-attempt/context fences, and generic unconfirmed recovery are unchanged.

Evidence:

• Trustworthy unchanged-runtime RED: 1 expected failure / 243 skipped; test-only digest df02329a39ee24b127f801d4a8726f5748bdff0b992b8706a16456bbeb2fd66f.
• AUTH-006G: 22/22 pass; Account: 265/265 pass.
• Full frontend: 18/18 suites, 1274/1274 tests pass under Node 20.
• Repository Node tests: 105/105 pass; TypeScript, scoped ESLint, unchanged lint baseline, diagnostic build, and diff-check pass.
• Independent frontend/accessibility/mobile, security/privacy/race, backup-officer/operations, exact-head PR, and exact-main reviews: GO.
• Exact-head CI run 31768237900: 5/5 required jobs passed.
• Exact-head Netlify preview 6a7e9193716ef50008b3b8b4: ready for the exact candidate, deploy-preview only, published_at: null, no Functions or Edge Functions, and noindex.
• Exact-main CI run 31768544349: completed successfully on the exact merge.
• Netlify main attempt 6a7e92fa1ac7d40008d0787d stopped with state: error and published_at: null; it did not publish this source revision.

Production state remains separate and unchanged: the site still points to inert #623 deploy 6a7e072f8f346b0008510d29 at control commit 9d5cc8612b4321172370bd949d307e7e4ac0ec7d, and the public marker still identifies #623 source c2d87d1f69f15e128a0bc9b1b9f915b7c8417aec / tree 411aa6ec9a9459f5d923030533ffc7c007fe6908. Directory availability remains literal false with blob 295909b0df8dd7c54a0f164f99d4943656aece4b. Active #616 Strava blobs remain 2eb48945061ab5ad2a896c6835f308cefd7fe63a and d1792d390bd57608fecab84341a6e5916fcf8196; RISK-024 is byte-identical.

No Firebase deployment, provider configuration, account/sign-in action, production-data action, or live-behavior verification occurred. Unconfirmed-save recovery focus, validation error association, Edit-to-input focus, and Cancel-to-Edit focus remain separate follow-ups.

The exact-path claim is now released.